@yemi33/minions 0.1.2375 → 0.1.2377

package/dashboard/js/settings.js

@@ -890,13 +890,11 @@ async function initRuntimeFleetUI(engineCfg, agentsCfg) {
 }
 
 /**
- * Replace the input/select at `inputId` with a dropdown when the runtime
- * exposes a model list, or a free-text input when `{ models: null }` (e.g.
- * Claude or model-discovery disabled). The "Default (CLI chooses)" option is
- * always present and submits empty string.
+ * Render an editable model field backed by discovered-model suggestions.
+ * Discovery is advisory: staged/future/custom model IDs must remain typeable.
  */
-async function loadModelsForRuntime(runtimeName, inputId, currentValue) {
-  const wrap = document.getElementById(inputId)?.parentElement;
+async function loadModelsForRuntime(runtimeName, inputId, currentValue, forceRefresh) {
+  const wrap = document.getElementById(inputId + '-wrap') || document.getElementById(inputId)?.parentElement;
   if (!wrap) return;
   const token = _nextModelLoadToken('runtime', inputId);
   if (!runtimeName) {
@@ -906,42 +904,37 @@ async function loadModelsForRuntime(runtimeName, inputId, currentValue) {
   }
   let payload = { models: null };
   try {
-    const res = await fetch('/api/runtimes/' + encodeURIComponent(runtimeName) + '/models');
+    const suffix = forceRefresh ? '/models/refresh' : '/models';
+    const res = await fetch('/api/runtimes/' + encodeURIComponent(runtimeName) + suffix, forceRefresh ? { method: 'POST' } : undefined);
     if (res.ok) payload = await res.json();
   } catch { /* fall through to free-text */ }
 
   if (!_isCurrentModelLoad('runtime', inputId, token)) return;
   const models = Array.isArray(payload.models) ? payload.models : null;
-  if (!models || models.length === 0) {
-    // Free-text fallback — let the user type anything (custom Anthropic /
-    // OpenAI model IDs, future models, etc.).
-    // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: currentValue; inputId is an internal fixed DOM id)
-    wrap.innerHTML = '<input id="' + inputId + '" value="' + escHtml(currentValue || '') + '" placeholder="Default (CLI chooses)" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:var(--text-md)">';
-    return;
-  }
-  // Dropdown. The first option submits empty string → "Default (CLI chooses)".
-  let opts = '<option value=""' + (!currentValue ? ' selected' : '') + '>Default (CLI chooses)</option>';
-  for (const m of models) {
+  const listId = inputId + '-options';
+  let opts = '';
+  for (const m of (models || [])) {
     const id = m.id || m.name || '';
     if (!id) continue;
-    const label = m.name && m.name !== id ? (id + ' — ' + m.name) : id;
-    opts += '<option value="' + escHtml(id) + '"' + (id === currentValue ? ' selected' : '') + '>' + escHtml(label) + '</option>';
+    const label = m.name && m.name !== id ? m.name : '';
+    opts += '<option value="' + escHtml(id) + '"' + (label ? ' label="' + escHtml(label) + '"' : '') + '></option>';
   }
-  // If the current value isn't in the model list (custom / older choice),
-  // surface it as a selectable option so the user doesn't lose it on next save.
-  if (currentValue && !models.some(m => (m.id || m.name) === currentValue)) {
-    opts += '<option value="' + escHtml(currentValue) + '" selected>' + escHtml(currentValue) + ' (custom)</option>';
+  const title = forceRefresh ? 'Model list refreshed' : 'Refresh models from the selected CLI';
+  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml()
+  wrap.innerHTML = '<div style="display:flex;gap:4px"><input id="' + inputId + '" list="' + listId + '" value="' + escHtml(currentValue || '') + '" placeholder="Default (CLI chooses)" autocomplete="off" style="min-width:0;flex:1;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:var(--text-md)"><button type="button" data-model-refresh title="' + escHtml(title) + '" aria-label="Refresh model list" style="padding:3px 8px;background:var(--surface2);border:1px solid var(--border);border-radius:4px;color:var(--muted);cursor:pointer">↻</button></div><datalist id="' + listId + '">' + opts + '</datalist>';
+  const refresh = wrap.querySelector('[data-model-refresh]');
+  if (refresh) {
+    refresh.addEventListener('click', async function() {
+      const liveValue = document.getElementById(inputId)?.value || '';
+      refresh.disabled = true;
+      await loadModelsForRuntime(runtimeName, inputId, liveValue, true);
+    });
   }
-  // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; all user data wrapped in escHtml() (fields: model id, model label, currentValue; inputId is an internal fixed DOM id)
-  wrap.innerHTML = '<select id="' + inputId + '" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:var(--text-md)">' + opts + '</select>';
 }
 
 /**
- * Per-agent model hydrator. Replaces the placeholder input in the cell
- * `[data-runtime-model="<agentId>"]` with a <select> of valid models for the
- * given runtime. Output element keeps `data-agent` + `data-field="model"` so
- * the existing save flow picks it up unchanged. Free-text input fallback
- * when the runtime returns no model list (Claude / discovery disabled).
+ * Per-agent model hydrator. The catalog is a datalist rather than a closed
+ * select so newly released and custom IDs stay available.
  */
 async function loadModelsForAgent(agentId, runtimeName, currentValue) {
   const cell = document.querySelector('[data-runtime-model="' + agentId + '"]');

package/dashboard.js

@@ -4502,6 +4502,7 @@ async function _preflightModelCheck({ runtime: cliOverride, model: modelOverride
   const resolvedModel = llm._resolveModelForRuntime(adapter, { model: modelOverride, engineConfig });
   if (!resolvedModel) return null;
   if (!adapter.capabilities || adapter.capabilities.modelDiscovery !== true) return null;
+  if (adapter.capabilities.strictModelCatalog === false) return null;
 
   let list;
   try {
@@ -10572,8 +10573,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           });
           writeCcEvent(envelope);
           liveState.donePayload = envelope;
-          _ccStreamEnded = true;
           if (liveState.endResponse) liveState.endResponse();
+          _ccStreamEnded = true;
           _scheduleCcLiveCleanup(tabId);
           _logCcStreamEnd(_ccTelemetry, 'error-preflight-model-unavailable', { runtime: preflightFailure.runtime });
           return;
@@ -10621,8 +10622,9 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           if (initial.missingRuntime) return initial;
 
           // Handle failure — non-zero exit with text = max_turns or partial success, still usable
-          if (!initial.text && wasResume && initial.code !== 0 && !req.destroyed) {
-            // Resume failed (stale/expired session) — auto-retry as fresh session (skip if client already disconnected)
+          if (!initial.text && wasResume && initial.code !== 0) {
+            // Resume failed (stale/expired session) — auto-retry as fresh. A
+            // briefly disconnected client can reattach to the live turn.
             console.log(`[CC-stream] Resume failed (code=${initial.code}) — retrying fresh`);
             const freshPreamble = buildCCStatePreamble();
             const freshCarryover = _buildTranscriptCarryover(body.transcript, { currentMessage: body.message });
@@ -10672,11 +10674,6 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         // treating an empty `text` as a failure. A genuinely empty turn has
         // both text and raw empty.
         if ((!result.text && !result.raw) || result.error) {
-          if (req.destroyed) {
-            _ccStreamEnded = true;
-            _logCcStreamEnd(_ccTelemetry, 'llm-empty-client-gone', { code: result.code });
-            return;
-          }
           // W-mpmwxni2000c25c7-b — surface the typed error envelope as a
           // distinct SSE `event: error` frame so the client renders a real
           // error UI (with a retry hint derived from `retriable`) instead of
@@ -11316,20 +11313,18 @@ What would you like to discuss or change? When you're happy, say "approve" and I
               knownForResolved = new Set(list.models.map(m => m.id || m.name).filter(Boolean));
             }
           } catch { /* unknown runtime */ }
-          if (knownForResolved && !knownForResolved.has(runtimeModelStr)) {
-            return `not a valid model for runtime "${resolvedRuntime}" (known: ${[...knownForResolved].slice(0, 4).join(', ')}${knownForResolved.size > 4 ? '…' : ''})`;
-          }
-          if (!knownForResolved) {
-            // Free-text runtime (Claude). Reject only if the raw model belongs to a different runtime's published list.
-            for (const rt of _engineRuntimes.listRuntimes()) {
-              if (rt === resolvedRuntime) continue;
-              try {
-                const otherList = await _engineModelDiscovery.getRuntimeModels(rt, { config });
-                if (Array.isArray(otherList?.models) && otherList.models.some(m => (m.id || m.name) === modelStr)) {
-                  return `belongs to runtime "${rt}" but resolved runtime is "${resolvedRuntime}" — incompatible combination`;
-                }
-              } catch { /* skip */ }
-            }
+          if (knownForResolved && knownForResolved.has(runtimeModelStr)) return null;
+          // Catalogs lag staged releases and local/custom providers. Unknown is
+          // therefore allowed, but a model positively published by a different
+          // runtime remains an actionable incompatible-combination error.
+          for (const rt of _engineRuntimes.listRuntimes()) {
+            if (rt === resolvedRuntime) continue;
+            try {
+              const otherList = await _engineModelDiscovery.getRuntimeModels(rt, { config });
+              if (Array.isArray(otherList?.models) && otherList.models.some(m => (m.id || m.name) === modelStr)) {
+                return `belongs to runtime "${rt}" but resolved runtime is "${resolvedRuntime}" — incompatible combination`;
+              }
+            } catch { /* skip */ }
           }
           return null;
         }
@@ -11486,15 +11481,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
               const resolvedCli = config.agents[id].cli || config.engine.defaultCli || 'copilot';
               const runtimeModelStr = _resolveModelForRuntime(candidate, resolvedCli);
               const knownModels = await _modelsFor(resolvedCli);
-              // Two validation paths:
-              //   1. If the runtime publishes a model list, enforce membership.
-              //   2. If the runtime doesn't (Claude), still reject when the
-              //      model belongs to a DIFFERENT runtime's list — that's how
-              //      we catch claude+gpt-5.5 (gpt-5.5 is in Copilot's list).
+              // Published membership is a positive signal, not a closed enum:
+              // staged releases/custom providers can legitimately be absent.
+              // Still reject IDs positively owned by a different runtime.
               let rejection = null;
-              if (knownModels && !knownModels.has(runtimeModelStr)) {
-                rejection = `not a valid model for runtime "${resolvedCli}" (known: ${[...knownModels].slice(0, 4).join(', ')}${knownModels.size > 4 ? '…' : ''})`;
-              } else if (!knownModels) {
+              if (!knownModels || !knownModels.has(runtimeModelStr)) {
                 const owner = await _ownerOfModel(candidate);
                 if (owner && owner !== resolvedCli) {
                   rejection = `belongs to runtime "${owner}" but agent uses "${resolvedCli}" — incompatible combination`;

package/engine/github.js

@@ -99,6 +99,28 @@ function getRepoSlug(project) {
   return `${org}/${repo}`;
 }
 
+function getPrRepoSlug(project, pr) {
+  const scope = shared.getPrScopeInfo(pr, pr?.url || '')?.scope || '';
+  if (scope && scope === shared.getProjectPrScope(project)) return getRepoSlug(project);
+  if (scope.startsWith('github:')) return scope.slice('github:'.length);
+  return getRepoSlug(project);
+}
+
+function getProjectRepoSlugs(project) {
+  const primary = getRepoSlug(project);
+  const slugs = primary ? [primary] : [];
+  const seen = new Set(slugs.map(slug => slug.toLowerCase()));
+  for (const scope of shared.getProjectAllPrScopes(project)) {
+    if (!scope.startsWith('github:')) continue;
+    const slug = scope.slice('github:'.length);
+    if (!seen.has(slug)) {
+      slugs.push(slug);
+      seen.add(slug);
+    }
+  }
+  return slugs;
+}
+
 function getConfiguredGitHubAuthorLogins(config = {}) {
   const accounts = config?.engine?.ghAccounts;
   if (!accounts || typeof accounts !== 'object') return new Set();
@@ -520,40 +542,40 @@ async function forEachActiveGhPr(config, callback) {
     const src = project?.workSources?.pullRequests || config?.workSources?.pullRequests;
     if (src && src.enabled === false) continue;
 
-    const slug = getRepoSlug(project);
-    if (!slug) continue;
-
-    // Skip projects in backoff (inaccessible repo)
-    if (isSlugInBackoff(slug)) continue;
-
     const prs = getPrs(project);
     const activePrs = prs.filter(pr => PR_POLLABLE_STATUSES.has(pr.status)
       && shared.isPrCompatibleWithProject(project, pr, pr.url || ''));
     if (activePrs.length === 0) continue;
 
-    // Probe repo accessibility before iterating PRs — avoids N warnings per inaccessible repo.
-    // W-mp5trwh60008386d: ghApi returns the GH_NOT_FOUND sentinel on 404 (a frozen object,
-    // *not* null). The pre-fix gate only matched `null`, so a 404 on the base repo (caused by
-    // a multi-account `gh auth` switch, network blip, or token rotation) fell through and every
-    // per-PR call below 404'd, permanently flipping all active PRs to `abandoned`. We now treat
-    // both null and GH_NOT_FOUND as "skip the project for this tick" and explicitly do NOT
-    // increment per-PR `_consecutive404s` counters since no per-PR call was made.
-    const probe = await ghApi('', slug);
-    if (probe === null || probe === GH_NOT_FOUND) {
-      if (probe === GH_NOT_FOUND) {
-        log('warn', `GitHub repo probe for ${slug} returned 404 — skipping all per-PR polls for this project this tick (avoids spurious abandonments). Per-PR 404 counters NOT incremented.`);
-      }
-      recordSlugFailure(slug);
-      continue;
-    }
-    resetSlugBackoff(slug);
-
     let projectUpdated = 0;
     const updatedRecords = [];
+    const slugProbes = new Map();
 
     for (const pr of activePrs) {
       const prNum = shared.getPrNumber(pr);
       if (!prNum) continue;
+      const slug = getPrRepoSlug(project, pr);
+      if (!slug) continue;
+
+      let probeResult = slugProbes.get(slug);
+      if (probeResult === undefined) {
+        if (isSlugInBackoff(slug)) {
+          probeResult = 'fail';
+        } else {
+          const probe = await ghApi('', slug);
+          probeResult = (probe === null || probe === GH_NOT_FOUND) ? 'fail' : 'ok';
+          if (probeResult === 'fail') {
+            if (probe === GH_NOT_FOUND) {
+              log('warn', `GitHub repo probe for ${slug} returned 404 — skipping all per-PR polls for this repository this tick (avoids spurious abandonments). Per-PR 404 counters NOT incremented.`);
+            }
+            recordSlugFailure(slug);
+          } else {
+            resetSlugBackoff(slug);
+          }
+        }
+        slugProbes.set(slug, probeResult);
+      }
+      if (probeResult !== 'ok') continue;
 
       try {
         const before = shared.snapshotPrRecord(pr);
@@ -612,7 +634,10 @@ async function forEachActiveGhPr(config, callback) {
   const centralPrs = safeJsonArr(centralPath);
   // Build a slug→project map for configured GitHub projects so we can detect
   // PRs that are actually owned by the project loop (present in per-project file).
-  const configuredGhProjectsBySlug = new Map(projects.map(p => [getRepoSlug(p), p]));
+  const configuredGhProjectsBySlug = new Map();
+  for (const project of projects) {
+    for (const slug of getProjectRepoSlugs(project)) configuredGhProjectsBySlug.set(slug.toLowerCase(), project);
+  }
   const activeCentral = centralPrs.filter(pr => {
     if (!PR_POLLABLE_STATUSES.has(pr.status)) return false;
     if (!pr.url) return false;
@@ -621,7 +646,7 @@ async function forEachActiveGhPr(config, callback) {
     // the project loop will never see it — the central branch must poll it.
     const ghMatch = pr.url.match(/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/);
     if (ghMatch) {
-      const owningProject = configuredGhProjectsBySlug.get(ghMatch[1]);
+      const owningProject = configuredGhProjectsBySlug.get(ghMatch[1].toLowerCase());
       if (owningProject) {
         const projectPrs = safeJsonArr(projectPrPath(owningProject));
         if (projectPrs.some(p => p.id === pr.id)) return false; // present → project loop handles it
@@ -1425,12 +1450,6 @@ async function reconcilePrs(config) {
   let totalAdded = 0;
 
   for (const project of projects) {
-    const slug = getRepoSlug(project);
-    if (!slug) continue;
-
-    // Skip projects in backoff (inaccessible repo)
-    if (isSlugInBackoff(slug)) continue;
-
     // Skip projects with no tracked PRs and no work items — nothing to reconcile
     const existingPrs = getPrs(project);
     if (existingPrs.length === 0) {
@@ -1441,18 +1460,21 @@ async function reconcilePrs(config) {
       } catch { continue; }
     }
 
-    // Fetch open PRs — paginate to handle repos with >100 open PRs
-    const prsData = await ghApi('/pulls?state=open&per_page=100', slug, { paginate: true, timeout: 60000 });
-    if (!prsData || !Array.isArray(prsData)) {
-      recordSlugFailure(slug);
-      continue;
+    const ghPrs = [];
+    for (const slug of getProjectRepoSlugs(project)) {
+      if (isSlugInBackoff(slug)) continue;
+      // Fetch open PRs — paginate to handle repos with >100 open PRs.
+      const prsData = await ghApi('/pulls?state=open&per_page=100', slug, { paginate: true, timeout: 60000 });
+      if (!prsData || !Array.isArray(prsData)) {
+        recordSlugFailure(slug);
+        continue;
+      }
+      resetSlugBackoff(slug);
+      for (const pr of prsData) {
+        const branch = pr.head?.ref || '';
+        if (branchPatterns.some(pat => pat.test(branch))) ghPrs.push({ pr, slug });
+      }
     }
-    resetSlugBackoff(slug);
-
-    const ghPrs = prsData.filter(pr => {
-      const branch = pr.head?.ref || '';
-      return branchPatterns.some(pat => pat.test(branch));
-    });
 
     if (ghPrs.length === 0) continue;
 
@@ -1470,8 +1492,12 @@ async function reconcilePrs(config) {
     const centralItems = safeJsonArr(centralWiPath);
     const allItems = [...workItems, ...centralItems];
 
-    for (const ghPr of ghPrs) {
-      const prUrl = project.prUrlBase ? project.prUrlBase + ghPr.number : ghPr.html_url || '';
+    for (const { pr: ghPr, slug } of ghPrs) {
+      const primarySlug = getRepoSlug(project);
+      const prUrl = ghPr.html_url
+        || (slug.toLowerCase() === primarySlug?.toLowerCase() && project.prUrlBase
+          ? project.prUrlBase + ghPr.number
+          : `https://github.com/${slug}/pull/${ghPr.number}`);
       const prId = shared.getCanonicalPrId(project, ghPr.number, prUrl);
       // P-a7c4d2e8 (F3): validate API-derived branch ref before persistence
       // / regex matching. Defensive degrade — log and treat as missing on
@@ -1604,7 +1630,7 @@ async function reconcilePrs(config) {
  */
 async function checkLiveReviewStatus(pr, project) {
   try {
-    const slug = getRepoSlug(project);
+    const slug = getPrRepoSlug(project, pr);
     if (!slug) return null;
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
@@ -1654,7 +1680,7 @@ async function checkLiveReviewStatus(pr, project) {
 async function dismissPriorViewerChangesRequestedReviews(pr, project) {
   let tmpFile = null;
   try {
-    const slug = getRepoSlug(project);
+    const slug = getPrRepoSlug(project, pr);
     if (!slug) return null;
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
@@ -1758,7 +1784,7 @@ async function dismissPriorViewerChangesRequestedReviews(pr, project) {
  */
 async function checkLiveBuildAndConflict(pr, project) {
   try {
-    const slug = getRepoSlug(project);
+    const slug = getPrRepoSlug(project, pr);
     if (!slug) return null;
     const prNum = shared.getPrNumber(pr);
     if (!prNum) return null;
@@ -1846,9 +1872,6 @@ async function reconcileAbandonedPrs(config) {
   const slugProbeCache = new Map(); // slug → 'ok' | 'fail'
 
   for (const project of projects) {
-    const slug = getRepoSlug(project);
-    if (!slug) continue;
-
     const prPath = projectPrPath(project);
     const prs = safeJsonArr(prPath);
     // Filter: only abandoned PRs that don't already have the confirmed-404
@@ -1862,37 +1885,35 @@ async function reconcileAbandonedPrs(config) {
     );
     if (abandonedPrs.length === 0) continue;
 
-    // Probe base repo (cached). Failure → skip ALL of this slug's abandoned
-    // PRs and increment skipped counter — auth/access issue at boot, retry
-    // next restart.
-    let probeResult = slugProbeCache.get(slug);
-    if (probeResult === undefined) {
-      const probe = await ghApi('', slug);
-      probeResult = (probe === null || probe === GH_NOT_FOUND) ? 'fail' : 'ok';
-      slugProbeCache.set(slug, probeResult);
-    }
-    if (probeResult === 'fail') {
-      log('warn', `Abandoned PR reconciliation: skipping ${slug} (${abandonedPrs.length} PR${abandonedPrs.length === 1 ? '' : 's'}) — base-repo probe failed, retry next startup`);
-      skipped += abandonedPrs.length;
-      continue;
-    }
-
-    // Per-PR re-probe. Collect updates first, then apply via mutatePullRequests
-    // for atomic single-writer semantics. We match by prNumber on writeback
-    // (not id) because mutatePullRequests calls normalizePrRecords which can
-    // lowercase the id slug — prNumber is the stable key within a project's
-    // pull-requests.json.
-    const updates = []; // { prNumber, action, newStatus?, mergedAt? }
+    // Per-PR re-probe. Canonical ids keep same-number PRs from different
+    // repository scopes isolated during writeback.
+    const updates = []; // { prId, prNumber, action, newStatus?, mergedAt? }
     for (const pr of abandonedPrs) {
       const prNum = shared.getPrNumber(pr);
       if (!prNum) continue;
+      const slug = getPrRepoSlug(project, pr);
+      if (!slug) continue;
+      const prId = shared.getCanonicalPrId(project, pr, pr.url || '');
+      if (!prId) continue;
+
+      let probeResult = slugProbeCache.get(slug);
+      if (probeResult === undefined) {
+        const probe = await ghApi('', slug);
+        probeResult = (probe === null || probe === GH_NOT_FOUND) ? 'fail' : 'ok';
+        slugProbeCache.set(slug, probeResult);
+      }
+      if (probeResult === 'fail') {
+        log('warn', `Abandoned PR reconciliation: skipping ${slug} — base-repo probe failed, retry next startup`);
+        skipped++;
+        continue;
+      }
 
       try {
         const prData = await ghApi(`/pulls/${prNum}`, slug);
         if (prData === GH_NOT_FOUND) {
           // 404 with base-probe OK → genuinely deleted. Mark so we don't
           // re-probe this PR on future startups.
-          updates.push({ prNumber: prNum, action: 'confirm404' });
+          updates.push({ prId, prNumber: prNum, action: 'confirm404' });
           confirmedDeleted++;
           log('info', `Confirmed PR #${prNum} (${slug}): truly deleted, leaving abandoned`);
         } else if (prData) {
@@ -1915,6 +1936,7 @@ async function reconcileAbandonedPrs(config) {
             continue;
           }
           updates.push({
+            prId,
             prNumber: prNum,
             action: 'flip',
             newStatus,
@@ -1938,7 +1960,9 @@ async function reconcileAbandonedPrs(config) {
       const reconciledAt = ts();
       mutatePullRequests(prPath, (currentPrs) => {
         for (const upd of updates) {
-          const pr = currentPrs.find(p => shared.getPrNumber(p) === upd.prNumber);
+          const pr = currentPrs.find(p =>
+            shared.getCanonicalPrId(project, p, p.url || '') === upd.prId
+          );
           if (!pr) continue;
           // Defensive: never downgrade a merged record. Should already be
           // filtered by the abandoned-only scan above, but a concurrent writer

package/engine/llm.js

@@ -591,8 +591,9 @@ function _createStreamAccumulator({
       if (!id || !onToolUpdate) return;
       onToolUpdate(id, status);
     },
-    toolUseAlreadySeen(name, input) {
+    toolUseAlreadySeen(name, input, id = null) {
       if (!name) return false;
+      if (id) return toolUses.some(t => t.id === id);
       const stringified = JSON.stringify(input || {});
       return toolUses.some(t => t.name === name && JSON.stringify(t.input) === stringified);
     },

package/engine/model-discovery.js

@@ -99,6 +99,13 @@ async function getRuntimeModels(runtimeName, { force = false, ttlMs = MODEL_CACH
   }
 
   const cachePath = adapter.modelsCache || null;
+  // Runtime catalogs are versioned with the CLI that produced them. Codex in
+  // particular ships new bundled model IDs with CLI releases, so a one-hour
+  // time-only cache otherwise hides new models immediately after an upgrade.
+  let modelCacheKey = null;
+  if (typeof adapter.getModelCacheKey === 'function') {
+    try { modelCacheKey = await adapter.getModelCacheKey(); } catch { /* optional hint */ }
+  }
 
   // Cache hit path — only on non-forced reads. We accept any cached payload
   // whose `cachedAt` parses to a valid timestamp within the TTL window;
@@ -110,7 +117,8 @@ async function getRuntimeModels(runtimeName, { force = false, ttlMs = MODEL_CACH
       const ts = Date.parse(cached.cachedAt);
       if (Number.isFinite(ts)) {
         const age = Date.now() - ts;
-        if (age >= 0 && age < ttlMs) {
+        const versionMatches = !modelCacheKey || cached.modelCacheKey === modelCacheKey;
+        if (age >= 0 && age < ttlMs && versionMatches) {
           const models = Array.isArray(cached.models) ? cached.models : null;
           return { runtime: runtimeName, models, cachedAt: cached.cachedAt };
         }
@@ -134,7 +142,12 @@ async function getRuntimeModels(runtimeName, { force = false, ttlMs = MODEL_CACH
 
   const cachedAt = new Date().toISOString();
   if (cachePath) {
-    _writeCacheFile(cachePath, { runtime: runtimeName, models, cachedAt });
+    _writeCacheFile(cachePath, {
+      runtime: runtimeName,
+      models,
+      cachedAt,
+      ...(modelCacheKey ? { modelCacheKey } : {}),
+    });
   }
   return { runtime: runtimeName, models, cachedAt };
 }

package/engine/runtimes/codex.js

@@ -320,6 +320,17 @@ function _normalizeConfigOverrides(configOverrides) {
   return [];
 }
 
+const _MIME_EXT = {
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+  'image/gif': 'gif',
+  'image/webp': 'webp',
+};
+
+function _mimeToExt(mimeType) {
+  return _MIME_EXT[String(mimeType || '').toLowerCase()] || 'bin';
+}
+
 function buildArgs(opts = {}) {
   const {
     model,
@@ -329,11 +340,13 @@ function buildArgs(opts = {}) {
     sandbox = 'workspace-write',
     skipGitRepoCheck = true,
     configOverrides,
+    images,
+    tmpDir,
   } = opts;
 
   const args = ['exec'];
-  if (sessionId) args.push('resume', String(sessionId));
-
+  // These are `exec` options, not `exec resume` options. Codex's resume
+  // parser rejects flags such as --color and --sandbox after the subcommand.
   args.push('--json', '--color', 'never');
   if (model) args.push('--model', String(model));
   if (sandbox) args.push('--sandbox', String(sandbox));
@@ -347,6 +360,20 @@ function buildArgs(opts = {}) {
     args.push('--config', override);
   }
 
+  if (sessionId) args.push('resume', String(sessionId));
+
+  // Codex accepts repeatable --image paths on fresh and resumed turns. The
+  // call-scoped tmpDir is removed by engine/llm.js after the process exits.
+  if (Array.isArray(images) && images.length && tmpDir) {
+    for (let i = 0; i < images.length; i++) {
+      const img = images[i];
+      if (!img || !img.dataBase64) continue;
+      const filePath = path.join(tmpDir, `img-${i}.${_mimeToExt(img.mimeType)}`);
+      fs.writeFileSync(filePath, Buffer.from(img.dataBase64, 'base64'));
+      args.push('--image', filePath);
+    }
+  }
+
   args.push('-');
   return args;
 }
@@ -544,6 +571,21 @@ function _extractToolUse(obj) {
   const itemType = String(item?.type || '');
   if (!/tool|function|command|web_search/i.test(type) && !/tool|command|web_search/i.test(itemType)) return null;
   const data = item || obj.data || obj;
+  const id = _pickString(data.id, obj?.item_id, obj?.itemId, obj?.data?.item_id);
+  const rawStatus = String(data.status || obj?.status || '').toLowerCase();
+  const status = /fail|error|cancel/.test(rawStatus) ? 'failed'
+    : /complete|success/.test(rawStatus) ? 'completed'
+      : null;
+
+  if (/command_execution/i.test(itemType)) {
+    const command = _pickString(data.command, data.input);
+    if (!command) return null;
+    return { name: 'Bash', input: { command }, id: id || null, status };
+  }
+  if (/web_search/i.test(itemType)) {
+    const query = _pickString(data.query, data.input, data.arguments);
+    return { name: 'WebSearch', input: query ? { query } : {}, id: id || null, status };
+  }
   const name = _pickString(
     data.tool_name,
     data.toolName,
@@ -555,7 +597,7 @@ function _extractToolUse(obj) {
   );
   if (!name) return null;
   const input = data.arguments || data.args || data.input || data.function?.arguments || {};
-  return { name, input };
+  return { name, input, id: id || null, status };
 }
 
 function _usageFrom(obj) {
@@ -675,6 +717,17 @@ function parseError(rawOutput) {
   if (!text) return { message: '', code: null, retriable: true };
   const lower = text.toLowerCase();
 
+  if (/requires a newer version of codex|upgrade to the latest (?:app or )?cli|codex (?:cli )?is (?:too old|out of date)/i.test(text)) {
+    const name = _extractInvalidModelName(text)
+      || (text.match(/['"`]([A-Za-z0-9._\/-]+)['"`]/)?.[1])
+      || 'configured model';
+    return {
+      message: `The installed Codex CLI is too old for model "${name}". Upgrade Codex, refresh the model list, and try again.`,
+      code: 'config-error',
+      retriable: false,
+    };
+  }
+
   const hasAuth = /not authenticated|login required|please.*log.*in|api key.*invalid|invalid api key|\bunauthorized\b|\b401\b|\b403\b/i.test(text);
   if (hasAuth) {
     return { message: 'Codex authentication failed - run `codex login` or configure an OpenAI API key, then try again.', code: 'auth-failure', retriable: false };
@@ -773,6 +826,20 @@ async function listModels({ env = process.env, timeoutMs = 10000 } = {}) {
   }
 }
 
+function getModelCacheKey({ env = process.env, timeoutMs = 10000 } = {}) {
+  const resolved = resolveBinary({ env });
+  if (!resolved) return null;
+  try {
+    return _execFileCapture(resolved.bin, [...(resolved.leadingArgs || []), '--version'], {
+      env,
+      timeoutMs,
+      native: resolved.native,
+    }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
 function createStreamConsumer(ctx) {
   let deltaText = '';
   let terminalText = '';
@@ -789,7 +856,11 @@ function createStreamConsumer(ctx) {
     if (/reasoning|thinking/i.test(type)) ctx.notifyThinking();
 
     const toolUse = _extractToolUse(obj);
-    if (toolUse) ctx.pushToolUse(toolUse.name, toolUse.input);
+    if (toolUse) {
+      const seen = ctx.toolUseAlreadySeen(toolUse.name, toolUse.input, toolUse.id);
+      if (!seen) ctx.pushToolUse(toolUse.name, toolUse.input, toolUse.id);
+      if (toolUse.id && toolUse.status) ctx.updateToolUse(toolUse.id, toolUse.status);
+    }
 
     const delta = _extractDelta(obj);
     if (delta) {
@@ -823,6 +894,9 @@ const capabilities = {
   costTracking: false,
   modelShorthands: false,
   modelDiscovery: true,
+  // Bundled catalogs can lag staged/custom model availability. Let Codex
+  // validate unknown IDs so it can return its precise version/provider error.
+  strictModelCatalog: false,
   promptViaArg: false,
   budgetCap: false,
   bareMode: false,
@@ -830,9 +904,7 @@ const capabilities = {
   sessionPersistenceControl: false,
   resumePromptCarryover: true,
   streamConsumer: true,
-  // P-7b2e4d01: no image-input mechanism (CLI not installed during spike
-  // P-3f8a1c92). Engine code gates on this flag, never on runtime.name.
-  imageInput: false,
+  imageInput: true,
 };
 
 const INSTALL_HINT = 'install Codex CLI with `npm install -g @openai/codex` or `brew install --cask codex`, then run `codex login`.';
@@ -844,6 +916,7 @@ module.exports = {
   resolveBinary,
   capsFile: CAPS_FILE,
   listModels,
+  getModelCacheKey,
   modelsCache: MODELS_CACHE,
   spawnScript: path.join(ENGINE_DIR, 'spawn-agent.js'),
   installHint: INSTALL_HINT,
@@ -878,5 +951,6 @@ module.exports = {
   _extractModelsFromCatalog,
   _readCatalogIds,
   _extractInvalidModelName,
+  _extractToolUse,
   CAPS_SCHEMA_VERSION,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2375",
+  "version": "0.1.2377",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"